How PINs Stay Secret: PIN Blocks, PIN Pads, and End-to-End PIN Security

In our guide to cardholder verification methods we compared PIN, signature, and no-CVM as ways a shopper proves the card is theirs. That article answered when a PIN is used. This one answers the better question: what happens to those four digits after you type them? The answer is one of the payment industry’s quiet engineering triumphs — a design in which your PIN crosses half the planet, passes through machines owned by companies you’ve never heard of, and is verified by your bank, without any party in between ever being able to read it. Understanding PIN security end to end also explains why the attacks that do work look the way they do: criminals attack the edges of the tunnel, because the tunnel itself has never been the weak point.

Quick answer: A PIN is encrypted inside the terminal’s secure PIN pad at the instant of entry, packaged into an encrypted PIN block (per ISO 9564), and re-encrypted zone-by-zone inside hardware security modules as it travels from acquirer to network to issuer. No merchant system, network link, or intermediate party ever handles a readable PIN; only the issuer’s systems verify it.

The journey of four digits

Step 1: Entry inside a fortress

The keypad you touch is not a dumb accessory. On a certified device it is (or is wired directly into) a secure PIN entry component of a PCI PTS-approved terminal: tamper-responsive, physically shielded, and running firmware that encrypts the PIN within the protected boundary before any other part of the terminal — let alone the merchant’s POS software — can see it. The merchant’s till receives the transaction; it never receives the PIN. On SoftPOS deployments, software isolation and attestation stand in for the hardened keypad, under the MPoC rules we cover in our SoftPOS security guide.

Step 2: The PIN block

The PIN is not encrypted as a bare “1234.” It is first formatted into a PIN block — a structure defined by ISO 9564 that combines the PIN with other data, most importantly digits of the card number, before encryption. Binding the PIN to the PAN matters: it means a captured encrypted block is only meaningful for that card, and the modern format mandated across the industry (ISO format 4, AES-based) adds randomness so that the same PIN on the same card produces a different ciphertext every time. Two customers with PIN 1234 produce unrelated blocks; the same customer produces unrelated blocks on Tuesday and Wednesday. Pattern analysis gets nothing.

Step 3: Zone-to-zone translation

Payment networks are federations, and no single key spans them. Instead, the path is divided into encryption zones — terminal-to-acquirer, acquirer-to-network, network-to-issuer — each with its own keys. At every boundary the PIN block must be converted from one zone’s key to the next. This PIN translation is the step that would expose the PIN if done in ordinary software, so it never is: the decrypt-and-re-encrypt happens entirely inside a payment HSM, which accepts a block under key A and emits it under key B without the cleartext PIN ever existing outside tamper-resistant hardware. Terminal keys themselves are typically managed under DUKPT — a unique derived key per transaction — so compromising one transaction’s key buys an attacker exactly one already-used key.

Step 4: Verification at the issuer

Only the issuer (or its processor) verifies the PIN, again inside HSMs — either by recomputing a verification value from the card data and comparing, or by checking against securely stored offsets. The issuer approves or declines; the answer travels back; and at no point in the round trip did a human-readable PIN exist anywhere but under your fingertip and inside certified hardware. Offline chip-PIN verification (the card itself checking the PIN, used in some regions and transit scenarios) is the one variant that short-circuits the journey — the EMV chip verifies locally — with its own protections and trade-offs.

The rules that make it trustworthy

• ISO 9564 defines PIN block formats and PIN-management principles — including the foundational one: a cleartext PIN must never appear outside secure cryptographic hardware.
• PCI PIN Security Requirements govern everyone who processes PINs — acquirers, processors, key-injection facilities — covering key generation ceremonies, dual control and split knowledge, translation rules, and the mandated migration to stronger formats and AES-based key management. It is one of the sibling standards in the PCI family beyond the DSS, and, notably, one that ordinary merchants never certify against — the ecosystem deliberately keeps merchants out of the PIN business entirely.
• PCI PTS certifies the entry devices themselves, which is why “buy listed terminals, inspect them, control their custody” is the merchant’s whole job — the job we detail in defending POS terminals.

So how do criminals steal PINs?

By stepping outside the tunnel. Every prevalent PIN attack targets the moments before encryption or the humans around it:

1. Cameras and shoulder surfing. A pinhole camera above an ATM or a patient observer in a queue captures the PIN at the only place it’s visible: your hand. Paired with a skimmer capturing card data, this remains the classic combination — and the reason “cover your hand” is not folklore but sound threat modeling.
2. Overlay keypads. A counterfeit keypad glued atop the real one records keystrokes while passing presses through. Detectable by the inspection routines merchants should already run.
3. Terminal substitution and tampering. Replacing a merchant’s device with a doctored one — the attack that PTS tamper response, device inventories, and chain-of-custody discipline exist to defeat.
4. Social engineering. No cryptography protects a PIN the cardholder reads aloud to a “bank fraud department” caller. Voice-channel manipulation, covered in our piece on authorized push payment scams, is where PIN theft has migrated as hardware attacks got harder.
5. What you will not find on the list: decrypting PIN blocks in transit. Properly implemented, the cryptographic path has held for decades — the incidents that occur trace to procedural failures around keys and hardware, not broken mathematics.

What each audience should take from this

• Merchants: your responsibilities are physical and procedural — listed devices, tamper inspection, custody logs, and never engineering your own PIN handling. If any system you own can see a PIN, something is deeply mis-architected.
• Developers: PIN acceptance is not an integration feature to build; it arrives only inside certified hardware or validated SoftPOS solutions. Your code’s job is to stay out of the path.
• Cardholders: shield entry, treat any request to speak or type your PIN outside a payment device as fraud, and prefer contactless or wallet payments where a device biometric replaces PIN exposure altogether.

Frequently asked questions

Does the merchant ever see my PIN?

No. It is encrypted within the secure pad before the merchant’s systems receive anything, and merchant environments are deliberately excluded from PIN scope.

Is my PIN stored on the card’s magnetic stripe or chip?

Not on the stripe. Chips used for offline PIN verification hold a protected reference the card itself checks; online verification relies on issuer-side values. In no design is a readable PIN sitting on the card waiting to be copied.

Why do banks verify the PIN but never know it?

Issuers store verification values or offsets computed under HSM keys, sufficient to check a candidate PIN without retaining the PIN itself — the same one-way principle behind password hashing, implemented in hardware.

Are contactless payments weaker because no PIN is entered?

Low-value contactless trades PIN entry for transaction limits, velocity caps, and EMV’s dynamic cryptograms; higher values trigger a CVM (PIN or device biometric). Fewer PIN entries also means fewer chances for cameras and overlays — a security gain that surprises people.

What changed with the move to ISO format 4 PIN blocks?

AES encryption and per-transaction randomness in the block itself, replacing older DES-era formats — part of the industry’s staged migration to modern cryptography ahead of the post-quantum transition we cover separately.

PIN security is what mature payment engineering looks like: decide the secret may exist only inside certified hardware, build the entire global architecture around that rule, and leave attackers nothing but the edges. The edges — devices, custody, and people — are where your effort belongs.